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The following Listing of Claims is provided for the convenience of the Examiner. 
LISTING OF CLAIMS 

1-28. (Cancelled) 

29. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

a packet capturing module, for accessing the packets traversing a network, the packets 
having source and destination addresses of network devices exclusive of the apparatus, and for 
filtering the packets to produce packet data, wherein the packet capturing module produces 
the packet data by retrieving a predetermined address, comparing the predetermined address 
to the source and destination addresses for a current packet, and retaining the current packet 
when one of the source and destination addresses for the current packet matches the 
predetermined address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data, wherein the decoded packet data includes a plurality of 
patterns of packets, and for producing transaction data from the decoded packet data, wherein 
the transaction data is derived from a time value for identifying a substantially optimal 
collection of patterns of packets indicative.of transaction instances; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing the packet data and the transaction data to provide 
an indication of network usage. 
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30. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

a packet capturing module, for accessing the packets traversing a network, the packets 
having source and destination addresses of network devices exclusive of the apparatus, and for 
filtering, the packets to produce packet data, wherein the packet capturing module produces 
the packet data by accessing a predetermined address, comparing the predetermined address 
to the source and destination addresses for a current packet, and retaining the current packet 
when one of the source and destination addresses for the current packet matches the 
predetermined address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data and for producing transaction data from the decoded packet 
data; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing at least one of the packet data and the transaction 
data to provide an indication of network usage. 

31, (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

a packet capturing module, for accessing the packets traversing a network, the packets 
having source and destination addresses of network devices exclusive of the apparatus, and for 
filtering the packets to produce packet data, wherein the packet capturing module produces 
the packet data by retrieving a predetermined port address, comparing the predetermined port 
address to a source port address for a current packet, comparing the predetermined port 
address to a destination port address for the current packet, and retaining the current packet 
when one of the source and destination port addresses for the current packet matches the 
predetermined port address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data, wherein the decoded packet data includes a plurality of 
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patterns of packets, and for producing transaction data from the decoded packet data, wherein 
the transaction data is derived from a time value for identifying a substantially optimal 
collection of patterns of packets indicative of transaction occurrences; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing the packet data and the transaction data to provide 
an indication of network usage. 

32. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

a packet capturing module, for accessing the packets traversing a network, the packets 
having source and destination addresses other than an address corresponding to the apparatus, 
and for filtering the packets to produce raw packet data, wherein the packet capturing module 
produces the raw packet data by accessing a predetermined port address, comparingthe 
predetermined port address to a source port address for a current packet, comparingthe 
predetermined port address to a destination port address for the current packet, and retaining 
the current packet when one of the source and destination port addresses for the current 
packet matches the predetermined port address; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data and for producing transaction data from the decoded packet 
data; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing at least one of the raw packet data, the decoded 
packet data and a transaction data to provide an indication of network usage. 
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33. (Withdrawn) An apparatus for analyzing network activity, the apparatus 
comprising: 

a packet capturing module, for accessing a plurality of packets traversing a network, the 
packets having source and destination addresses of network devices exclusive of the apparatus, 
and for filtering the packets to produce packet data; 

a packet analyzing module, in communication with the packet capturing module, for 
producing decoded packet data and for producing transaction data from the decoded packet 
data, the packet'decoding module compromising (a) and (b) following: 

(a) a packet decoder, for accessing the packet data and producing the decoded 
packet data by searching in text of the packet data for one or more key words; and 

(b) a decoded packet recompHer, in communication with the packet decoder, for 
accessing the decoded packet data, segregating the packets from the decoded packet data into 
separate transactions between nodes by ordering according to thread and a time interval, 
sequencing the packets corresponding to each separate transaction by identifying a packet 
position in a pattern corresponding to each separate transaction, and linking together the data 
in each separate transaction when the identified positions are determined to produce the 
transaction data, wherein the transaction data is derived from a time value and identifies a 
collection of the patterns of packets that is substantially optimal for identifying transaction 
instances; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing the packet data and the transaction data to provide 
an indication of network usage. 

34. (Withdrawn) An apparatus for analyzing network activity, the apparatus 
comprising: 

a packet capturing module, for accessing packets traversing a network; the packets 
having source and destination addresses of network devices exclusive of the apparatus, and for: 
filtering the packets to produce packet data; 
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a packet analyzing module in communication with the packet capturing module, for 
producing decoded packet data and for producing transaction data from the decoded packet 
data, the packet analyzing module comprising: 

a packet decoder, for accessing the packet data and producing the decoded packet data; 

and 

a decoded packet recompiles in communication with the packet decoder, for accessing 
the decoded packet data, segregating the packets from the decoded packet data into separate 
transactions between nodes, sequencing the packets corresponding to each separate 
transaction, and linking together the data in each separate transaction to produce the 
transaction data; and 

a data management module, in communication with the packet capturing module and 
the packet analyzing module, for analyzing at least one of the packet data and the transaction 
data to provide an indication of network usage. 

35. (Previously Presented) For use with a network activity analyzer capable of being 
coupled to a network transmission medium, a method of analyzing network activity, the 
method comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 

filtering the packets to produce packet data by (a) through (c) following: 

(a) accessing a predetermined address; 

(b) comparing the predetermined address to the source and destination 
addresses for a current packet; and 

(c) retaining the current packet when one of the source and destination 
addresses for the current packet matches the predetermined address; 

producing decoded packet data, wherein the decoded packet data includes a plurality of 
patterns of packets; 
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producing transaction data from the decoded packet data, wherein the transaction data 
is derived from a time value and identifies a substantially optimal collection of patterns of 
packets indicative of transaction instances; and 

analyzing the packet data and the transaction data to provide an indication of network 

usage. 

36. (Previously Presented) For use with a network activity analyzer capable of being 
coupled to a network transmission medium, a method of analyzing network activity, the 
method comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 

filtering the packets to produce raw packet data by (a) through (c) following: 

(a) accessing a predetermined address; 

(b) comparing the predetermined address to the source and destination 
addresses for a current packet; and 

(c) retaining the current packet when one of the source and destination 
addresses for the current packet matches the predetermined address; 

producing decoded packet data; : 

producing transaction data from the decoded packet data; and 

analyzing the decoded packet data and the transaction data to provide . an indication of 
network usage. 

37. (Previously Presented) For use with a network activity analyzer capable of being 
coupled to a network transmission medium, a method of analyzing network activity, the 
method comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer; 
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filtering the packets to produce packet data by: (a) accessing a predetermined port 
address; (b) comparing the predetermined port address to source and destination port 
addresses for a current packet; and (c) retaining the current packet when one of the source and 
destination port addresses for the current packet matches the predetermined port address; 

producing decoded packet data, wherein the decoded packet data includes a plurality of 
patterns of packets; 

producing transaction data from the decoded packet data, wherein the transaction data 
is derived from a time value for identifying a substantially optimal collection of patterns of 
packets indicative of transaction occurrences; and 

analyzing the packet data and the transaction data to provide an indication of network 

usage. 

38. (Previously Presented) For use with a network activity analyzer capable of being 
coupled to a network transmission medium, a method of analyzing network activity, the 
method comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices other than an address corresponding to the network activity ', 
analyzer; 

filtering the packets to produce raw packet data by: accessing a predetermined port 
address; comparing the predetermined port address to source and destination port addresses 
for a current packet; and retaining the current packet when one of the source and destination 
port addresses for the current packet matches the predetermined port address; 

producing decoded packet data; 

producing transaction data from the decoded packet data; and 

analyzing at least one of the decoded packet data and the transaction data to provide an 
indication of network usage. 
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39. (Withdrawn) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of network devices exclusive of the network activity analyzer- 
filtering the packets to produce packet data; 

producing decoded packet data by searching in text of the packet data for one or more 
keywords; 

producing transaction data from the decoded packet data by (a) accessing the decoded 
packet data; (b) segregating the packets from the decoded packet data into separate 
transactions between nodes of the network by ordering according to thread and a time 
interval; (c) sequencing the packets corresponding to each separate transaction by identifying a 
packet position in a pattern corresponding to each separate transaction; and (d) linking 
togetherthe data in each separate transaction when the identified positions are determined to 
produce the transaction data, wherein the transaction data is derived from a time value and 
identifies a collection of the patterns that is substantially optimal. for identifying transaction 
instances; and 

analyzing the packet data and transaction data to provide an indication of network 

usage. 

40. (Withdrawn) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses other than an address corresponding to the network activity analyzer; 
filtering the packets to produce raw packet data; 
producing decoded packet data; 
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producing transaction data from the decoded packet data by accessing the decoded 
packet data; segregating the packets from the decoded packet data into separate transactions 
between nodes of the network, sequencing the packets corresponding to each separate 
transaction; and linking together the data in each separate transaction to produce the 
transaction data; and 

analyzing at least one of the raw packet data, the decoded packet data, and the 
transaction data to provide an indication of network usage. 

41. (Withdrawn) For use with a network activity analyzer capable of being coupled 
to a network transmission medium, a method of analyzing network activity, the method 
comprising: 

accessing packets traversing the network, the packets having source and destination 
addresses of devices exclusive of the activity analyzer; 
filtering the packets to produce packet data; 

producing decoded packet data by searching in text of the packet data for one or more 
keywords; 

producing transaction data from the decoded packet data by accessing the decoded 
packet data; segregating the packets from the decoded packet data into separate transactions 
between nodes by ordering according to thread and a time interval; sequencing the packets 
corresponding to each separate transaction by identifying a packet position in a pattern 
corresponding to each separate transaction; and linking together the data in each separate 
transaction when the identified positions are determined to produce the transaction data, 
wherein the transaction data is derived from a time value and identifies a collection of the 
patterns that is substantially optimal for identifying transaction instances; and 

producing translated transaction data from the transaction data wherein the translated 
transaction data includes response data aggregated according to a fixed time interval; and 

analyzing the packet data and the transaction data to provide an indication of network 

usage. 
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42. (Withdrawn) For use with a network activity analyzer capable of being coupied 
to a network trap mission medium, a method of analyzing network activity, the method 
comprising; 

accessing packets traversing the network, the packets having source and destination 
addresses of devices exclusive of the activity analyzer; 

filtering the packets to produce packet data; 

producing decoded packet data; 
. producing transaction data from the decoded packet data by accessing the decoded 
packet data; segregating; the packets from e decoded packet data into separate transactions 
between nodes; sequencing the packets corresponding to each separate transaction; and 
linking together the data in each separate transaction; 

producing translated transaction data from the transaction data; and 

analyzing the packet data and the transaction data to provide an indication of network 

usage. 

43. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: means for accessing packets traversing the network, the packets having 
source and destination addresses of devices exclusive of the network activity analyzer; 

means for filtering thee packets to produce packet data y wherein the means for filtering 
the packets to produce packet data includes routines for retrieving a predetermined address; 
comparing the predetermined address to the source and destination addresses for a current 
packet; and retaining the current packet when one of the source and destination addresses for 
the current, packet matches the predetermined address; 

means for producing decoded packet data, wherein the decoded packet data includes a 
plurality of patterns of packets; 

means for producing transaction data from, the decoded packet data, wherein the 
transaction data is derived from a time value for identifying a substantially optimal collection of 
patterns of packets indicative of transaction instances; and 
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means for analyzing the packet data and the transaction data to provide an indication of 
network usage. 

44. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

means for accessing packets traversing the network, the packets having source and 
destination addresses of devices exclusive of the network activity analyzer; 

means for filtering the packets to produce packet data, wherein the means for filtering 
the packets to produce packet data includes routines for retrieving a predetermined address; 
comparing the predetermined address to the source and destination addresses for a current 
packet; and retaining the current packet when one of the source and destination addresses for 
the current packet matches the predetermined address; 

means for producing decoded packet data; 

means for producing transaction data from the decoded packet data; and 
means for analyzing the packet data and the transaction data to provide an indication of 
network usage. 

45. (Previously Presented) An apparatus for analyzing network activity, the 
apparatus comprising: 

means for accessing packets traversing the network, the packets having source and 
destination addresses for network devices exclusive of the network activity analyzer; 

means for filtering the packets to produce packet data, wherein the means for filtering 
the packets to produce packet data includes routines for accessing a predetermined port 
address; comparing the predetermined port address to a source port address for a current 
packet; comparing the predetermined port address to a destination port address for the 
current packet; and retaining the current packet when one of the source and destination port 
addresses for the current packet matches the predetermined port address; 
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means for producing decoded packet data, wherein the decoded packet data includes a 
plurality of patterns of packets; 

means for producing transaction data from the decoded packet data, wherein the 
transaction data is derived from a time value for identifying a substantially optimal collection of 
packets indicative of transaction occurrences; and 

means for analyzing the packet data and the transaction data to provide an indication of 
network usage. 

46. (Previously Presented} An apparatus for analyzing network activity, the 
apparatus comprising: 

means for accessing packets traversing the network, the packets having source and 
destination addresses for network devices other than an address corresponding to the network 
activity analyzer; 

means for filtering the packets to produce raw packet data, wherein the means for 
filtering the packets to produce raw packet data includes routines for retrieving a 
predetermined port address; comparing the predetermined port address to a source port 
address for a current packet; comparing the predetermined port address to a destination port 
address for the current packet; and retaining the current packet when one of the source and 
destination port addresses for the current packet matches the predetermined port address; 

means for producing decoded packet data; 

means for producing transaction data from the decoded packet data; and 
means for analyzing at least one of the decoded packet data and the transaction data to 
provide an indication of network usage. 

47. (Withdrawn) An apparatus for analyzing network activity, the apparatus 
comprising; 

means for accessing packets traversing the network, the packets having source and 
destination addresses other than an address corresponding to the network activity analyzer; 
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means for filtering the packets to produce packet data; 

means for producing decoded packet data by searching in text of the packet data for 
one or more key words; 

means for producing transaction data from the decoded packet data, wherein the 
means for producing transact rata includes routines for accessing the decoded packet data; 
segregating the packets from the decoded packet data into separate transactions between 
nodes by ordering according to thread and a time interval; sequencing the packets 
corresponding to each separate transaction by identifying a packet position in a pattern 
corresponding to each separate transaction; and linking together the data in each separate 
transaction when the identified positions are determined to produce the transaction data, 
wherein the transaction data is derived from a time value and identifies a collection of the 
patterns that is substantially optimal for identifying transaction instances; and 

means for analyzing the packet data and the transaction data to provide an indication of 
network usage. 

48. (Withdrawn} An apparatus for analyzing network activity, the apparatus 
comprising; 

means for accessing packets traversing network, the packets having source and 
destination addresses other than address corresponding to the network activity analyzer; 
means for filtering the packets to produce raw packet data; 
means for producing decoded packet data; 

means producing transaction data from the decoded packet data, wherein the means, 
for producing transaction data includes routines for accessing the decoded packet data; 
segregating the packets from the decoded packet data into separate transactions between 
nodes sequencing the packets corresponding to each separate transaction; and linking together 
the data in each separate transaction to produce the transaction data; and 

means for analyzing the decoded packet data and the transaction data to provide an 
indication of network usage. 
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